A school roll is almost entirely children under this Act

Every other sector asks whether the DPDP Act applies to it. A school's question is narrower and harder: almost every person on its roll is a child under Sec. 2, which means Sec. 9 is not an edge case in the policy but the default setting for the institution.

What Sec. 9 requires, before any exemption

Verifiable consent of the parent or lawful guardian before processing a child's personal data. No processing likely to have a detrimental effect on a child's well-being. And no tracking, no behavioural monitoring, and no targeted advertising directed at children.

Taken alone that would make a modern school impossible to run. There would be no attendance system, no learning platform, no safeguarding alerts, no school bus tracking.

The carve-out, and its exact shape

Sec. 9(4) lets the Rules exempt classes of Data Fiduciary and specified purposes. Rule 12, with the Fourth Schedule, does so — and the shape matters more than the fact.

Educational institutions are relieved of verifiable parental consent and of the tracking prohibition, for processing limited to educational activities and the safety of enrolled students. Crèches and childcare centres get comparable relief for safety-related tracking. Transport providers for educational institutions are covered for location tracking during travel.

Every one of those is bounded by purpose. The relief is not "schools are exempt". It is "this processing, for this purpose, by this kind of entity".

So: biometric or card attendance, safeguarding monitoring, bus tracking on the school route, a learning platform recording progress — inside. The same CCTV reviewed to build behavioural profiles, learner data passed to an edtech vendor for engagement scoring, or anything sold or monetised — outside, and outside a prohibition rather than outside a consent requirement.

Colleges are a different institution with the same statute

Most undergraduates have completed eighteen, so Sec. 9 does not reach them and ordinary consent under Sec. 6(1) applies.

But intake at seventeen is common in India, and the obligation follows the individual, not the institution. A college therefore has a small population of children inside a large population of adults, and no way to apply the right rule to the right student without recording date of birth and acting on it. A policy that assumes a college has no children is wrong for some students in most years, and being wrong about a child is the expensive way to be wrong.

What applies regardless of age

Notice under Sec. 5 — to parents for children, to the student directly once they are an adult — in English or any of the 22 languages of the Eighth Schedule, which for most Indian institutions is a real requirement rather than a formality.

Security safeguards under Sec. 8(5) over a system holding addresses, health information, fee and bank details and examination records. Breach reporting under Sec. 8(6). The rights in Sec. 11 to 14, which include a parent's right to a summary of what is held about their child and who it was shared with.

The vendor chain is where this usually fails

Schools rarely process alone. There is a school management system, a learning platform, a fee gateway, a bus tracker, a photography vendor, an assessment provider. Each receives children's data on the institution's instruction.

The institution's Fourth Schedule relief does not travel down that chain automatically. It attaches to entities the Rules name and to the purpose being served. Before 13 May 2027 the question worth asking each vendor is not whether they are DPDP-ready, but which named purpose their processing of your students' data falls under — and what happens to it when a student leaves.